Europe Needs Its Own CFPB: Time to Rethink Consumer Protection in Payment Services
As the European Union finalizes its landmark Payment Services Regulation (PSR) and PSD3, we find ourselves at a critical turning point. The proposed rules under Article 59 PSR rightly aim to strengthen consumer protection in cases of impersonation fraud and authorized push payment (APP) scams.
According to the draft regulation, if a payment service provider (PSP) denies a consumer refund on the grounds of fraud or gross negligence, it must:
Justify its position to the relevant national authority (NCA) (Article 59 (2) b PSR) and
Inform the consumer of their right to appeal the decision before a national ombudsman or dispute resolution body (Article 59 (2) b (last sentence) PSR).
On paper, this sounds like a positive step forward. In practice, however, it simply isn’t enough.
EFRI: Five Years on the Front Line of Payment Fraud
Over the past five years, EFRI has worked with more than 1,600 victims of complex cross-border (mainly Pig butchering) fraud cases. All these victims did so called “authorized” transactions but in reality were tricked by scammers to “authorize”
Bank transfers to shell companies holding accounts at major EU banks
(Read our investigations on Deutsche Bank/Postbank and ING Bank N.V.)Card payments processed for fraudulent online platforms
(See our reporting on the Dutch PSP Payvision, a particularly troubling case.)Crypto transactions routed through unregulated or poorly monitored on-/off-ramp providers
(Read more in our analysis of Mercuryo, one such provider involved in multiple victim reports.)
We have pursued cases in Germany, Austria, the Netherlands, Denmark, and beyond. We’ve engaged with PSPs, regulators, ombudsmen, and judicial systems, and filed numerous AML reports across jurisdictions.
What we’ve learned: enforcement in EUROPE simply does not work in practice — not consistently, not transparently, and certainly not in favor of the many victims.
National Competent Authorities (NCAs): Protecting PSPs, Not Victims!
Although NCAs are tasked with overseeing PSPs and enforcing EU regulations, EFRI’s experience over five years of fraud casework suggests a troubling pattern
NCAs rarely seriously challenge PSPs, even when strong evidence of systemic fraud facilitation exists.
Victims report being ignored, deflected, or dismissed, especially when banks or large PSPs are involved (compare our petition on the Payvision case. DNB´s stance is just a pure disgrace).
Instead of acting as impartial regulators, many NCAs appear structurally aligned with the interests of the institutions they supervise.
In practice, the function of many NCAs has become one of passive gatekeeping — more focused on limiting reputational damage for the local banks and PSPs than on protecting consumer rights.
This systemic failure undermines the spirit of EU regulation and erodes public trust.
The Ombudsman Illusion: A Failing System for Fraud Victims
The PSR envisions a consumer-friendly system where victims can escalate disputes to national ombudsmen or ADR bodies. In reality, however, the European ombudsman network has proven to be ineffective and largely irrelevant in the context of cross-border payment fraud.
EFRI’s own experience over the past five years confirms this failure:
In Germany, Austria, and the Netherlands, ombudsman institutions openly admitted they were not responsible for handling cross-border payment fraud, even when EU banks and EU-based PSPs were involved.
The Danish ombudsman initially launched an investigation — only to conclude, after two years, that they could not make a decision, advising the victims to start court proceedings.
In other countries, victims face lengthy delays, non-responses, or bureaucratic loops that offer no realistic path to justice.
Banks and PSPs can act without fear of consumer-level accountability.
A clear example of a non-working Ombudsman system is the systemic rejection of chargeback claims in Germany.
In most fraud-related cases — even when strong consumer evidence is provided — chargebacks are routinely denied at first instance by the German banks and consumers are told to pursue lengthy and costly court proceedings. Without an effective ombudsman or ADR mechanism to challenge these denials, there is no meaningful check on PSP behaviour.
These are not isolated incidents — they are symptoms of a system fundamentally unprepared and unequipped to protect EU consumers in complex fraud cases.
The Bottom Line!
Europe has no consistent, empowered, and victim-focused enforcement infrastructure. Victims are shuttled between institutions, while PSPs operate with minimal accountability.
This is why EFRI is calling for a European-level financial consumer protection authority — with real powers to investigate, enforce, and stand up for victims across borders.
